From 1bf2e46dd8080775f3f82ad8e0d568bc2ae00ae4 Mon Sep 17 00:00:00 2001
From: weijiafu14 <17469139+weijiafu14@users.noreply.github.com>
Date: Tue, 17 Mar 2026 16:24:30 +0800
Subject: [PATCH] fix: use allowlist for Gemini native request fields to
 prevent 400

Fixes #130

The inbound normalizer forwarded all unknown top-level fields to Gemini
API. Client-specific fields like requestId caused upstream 400 errors.

Changed from blocklist (only 3 entries) to allowlist of known Gemini API
fields: contents, systemInstruction, cachedContent, safetySettings,
generationConfig, tools, toolConfig, labels, model.
---
 .../gemini/generate-content/inbound.ts         | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/server/transformers/gemini/generate-content/inbound.ts b/src/server/transformers/gemini/generate-content/inbound.ts
index 6a90633..e62dfb6 100644
--- a/src/server/transformers/gemini/generate-content/inbound.ts
+++ b/src/server/transformers/gemini/generate-content/inbound.ts
@@ -194,14 +194,22 @@ export const geminiGenerateContentInbound = {
       next.generationConfig = generationConfig;
     }
 
-    const strippedKeys = new Set([
-      'reasoning',
-      'reasoning_effort',
-      'reasoning_budget',
+    // Only forward fields that Gemini API supports. Unknown fields
+    // (e.g. requestId, frequency_penalty) cause upstream 400 errors.
+    const allowedPassthroughKeys = new Set([
+      'contents',
+      'systemInstruction',
+      'cachedContent',
+      'safetySettings',
+      'generationConfig',
+      'tools',
+      'toolConfig',
+      'labels',
+      'model',
     ]);
 
     for (const [key, value] of Object.entries(body)) {
-      if (strippedKeys.has(key)) continue;
+      if (!allowedPassthroughKeys.has(key)) continue;
       if (next[key] !== undefined) continue;
       next[key] = cloneJsonValue(value);
     }